tree 550e6fcb00d732a3c018b3258302f8ffd61a4379
parent a210fd32a46bae6d05b43860fe3b47732501d63b
author Mimi Zohar <zohar@linux.vnet.ibm.com> 1531505158 -0400
committer James Morris <james.morris@microsoft.com> 1531769517 -0700

ima: based on policy require signed kexec kernel images

The original kexec_load syscall can not verify file signatures, nor can
the kexec image be measured.  Based on policy, deny the kexec_load
syscall.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.morris@microsoft.com>